DF-2427 / run_battery1_dmesg.iter1.log
Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 34138 min=32472 max=80398
TSC clock: 3600007412 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x60fb1 Family=0xf Model=0x6b Stepping=1
Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
AMD Features=0x20100800<SYSCALL,NX,LM>
AMD Features2=0x1<LAHF>
MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory = 4293381120 (4094 MB)
avail memory = 4088926208 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500002900 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 33333 Hz (30 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
boot() called on cpu#1
Switching to cpu #0 for shutdown
Waiting (max 60 seconds) for system thread swapcached to stop...stopped
Waiting (max 60 seconds) for system thread vnlru to stop...stopped
Waiting (max 60 seconds) for system thread consttyd to stop...stopped
Waiting (max 60 seconds) for system thread bufdaemon to stop...stopped
Waiting (max 60 seconds) for system thread bufdaemon_hw to stop...stopped
syncing disks... 0 0 0
done
v-chain 0xfffff8008fb604c0 volume.0 0000000000000010 0000000000000000/0 mir=00000000000000f1
[00002000] (?) refs=1
f-chain 0xfffff8008fb60640 freemap.0 0000000000000010 0000000000000000/0 mir=00000000000000f1
[00002000] (?) refs=1
Uptime: 49m43s
Rebooting...
Copyright (c) 2003-2026 The DragonFly Project.
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
DragonFly 6.5-DEVELOPMENT #2: Mon Oct 19 12:27:50 UTC 2026
root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
acpi_hpet: frequency 100000000
Using cputimer HPET for TSC calibration
Timer latency (in TSC ticks): 32455 min=32278 max=32658
TSC clock: 3600010351 Hz, NOT invariant
CPU: QEMU Virtual CPU version 2.5+ (3600.01-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x60fb1 Family=0xf Model=0x6b Stepping=1
Features=0x1783fbfd<FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x80202001<SSE3,CX16,x2APIC,VMM>
AMD Features=0x20100800<SYSCALL,NX,LM>
AMD Features2=0x1<LAHF>
MONITOR/MWAIT Features=0x2<INTBRK>
VMM/Hypervisor: Origin="KVMKVMKVM"
real memory = 4293381120 (4094 MB)
avail memory = 4088664064 (3899 MB)
LAPIC: enter X2APIC mode
madt_lapic_probe: lapic_count=6 x2apic_count=0
ACPI CPUS = 6
lapic: divisor index 0, frequency 500002960 Hz
CPU Topology: cores_per_chip: 6; threads_per_core: 1; chips_per_package: 1;
srat_probe: can't locate SRAT
SMI Frequency (worst case): 34482 Hz (29 us)
Initialize MI interrupts for 6 cpus
TSC is not invariant, no further tests will be performed
Spectre: support=( none ) req=ffff operating=( none )
MDS: support=( none ) req=ffff operating=( none )
machdep.meltdown_mitigation enabled to protect against (mostly Intel) meltdown bug
system call performance will be impacted
interrupt uses mplock: swi_taskq
wdog: In-kernel automatic watchdog reset enabled
md0: Malloc disk
evdev device loaded.
kbd1 at kbdmux0
ACPI: RSDP 0x00000000000F59A0 000014 (v00 BOCHS )
ACPI: RSDT 0x00000000BFFE1CAC 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x00000000BFFE1B38 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x00000000BFFE0040 001AF8 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x00000000BFFE0000 000040
ACPI: APIC 0x00000000BFFE1BAC 0000A0 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x00000000BFFE1C4C 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x00000000BFFE1C84 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
sc0: <System console> on motherboard
sc0: VGA <16 virtual consoles, flags=0x100>
acpi0: <BOCHS BXPC> on motherboard
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI FADT: SCI testing interrupt mode ...
ACPI FADT: SCI select level/high
acpi0: Power Button (fixed)
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
acpi_timer0 on acpi0
isab0: <ACPI Generic ISA bridge> on acpi0
isa0: <ISA bus> on isab0
cpu0: <ACPI CPU> on acpi0
cpu_cst0: <ACPI CPU C-State> on cpu0
cpu1: <ACPI CPU> on acpi0
cpu_cst1: <ACPI CPU C-State> on cpu1
cpu2: <ACPI CPU> on acpi0
cpu_cst2: <ACPI CPU C-State> on cpu2
cpu3: <ACPI CPU> on acpi0
cpu_cst3: <ACPI CPU C-State> on cpu3
cpu4: <ACPI CPU> on acpi0
cpu_cst4: <ACPI CPU C-State> on cpu4
cpu5: <ACPI CPU> on acpi0
cpu_cst5: <ACPI CPU C-State> on cpu5
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
isab1: <PCI-ISA bridge> at device 1.0 on pci0
isa1: <ISA bus> on isab1
atapci0: <Intel PIIX3 WDMA2 controller> port 0xc0a0-0xc0af,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
interrupt uses mplock: ata0
ata1: <ATA channel 1> on atapci0
interrupt uses mplock: ata1
acd0: DVDROM <QEMU DVD-ROM/2.5+> at ata1-master WDMA2
pci0: <bridge> (vendor 0x8086, dev 0x7113) at device 1.3 irq 9
vgapci0: <VGA-compatible display> mem 0xfebd0000-0xfebd0fff,0xfd000000-0xfdffffff at device 2.0 on pci0
vgapci0: Boot video device
virtio_pci0: <VirtIO PCI Network adapter> port 0xc080-0xc09f mem 0xfe000000-0xfe003fff,0xfebd1000-0xfebd1fff irq 11 at device 3.0 on pci0
vtnet0: <VirtIO Networking Adapter> on virtio_pci0
virtio_pci0: host features: 0x79bf8064 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,GuestAnnounce,RxModeExtra,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,TxAllGSO,MacAddress,DynOffload>
virtio_pci0: negotiated features: 0x198f8020 <RingIndirect,AnyLayout,NotifyOnEmpty,SetMacAddress,VLanFilter,RxMode,ControlVq,Status,MrgRxBuf,MacAddress>
virtio_pci0: using 3 MSI-X vectors
vtnet0: MAC address: 52:54:00:12:34:56
virtio_pci1: <VirtIO PCI Block adapter> port 0xc000-0xc07f mem 0xfe004000-0xfe007fff,0xfebd2000-0xfebd2fff irq 11 at device 4.0 on pci0
vtblk0: <VirtIO Block Adapter> on virtio_pci1
virtio_pci1: host features: 0x79007e54 <EventIdx,RingIndirect,AnyLayout,NotifyOnEmpty,WriteZeroes,Discard,MultiQueue,ConfigWCE,Topology,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: negotiated features: 0x10001a54 <RingIndirect,MultiQueue,ConfigWCE,FlushCommand,BlockSize,DiskGeometry,MaxNumSegs>
virtio_pci1: using 6 MSI-X vectors
vtblk0: Virtio: ncylinders at legacy maximum (16383), recalculating to 62415
vtblk0: Block size: 512
vtblk0: 30720MB (62914560 512 byte sectors: 16H 63S/T 16383C)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fac0000 pmp=0xfffff80090260000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DFH: ########## DF-2427 battery mode=1 BEGIN ##########
DFH: layout sizeof(amd_srb)=384 sizeof(amd_softc)=99784 sizeof(amd_target_info)=12
DFH: layout offsetof dev=0 tag=8 bsh=16 dmat=24 unit=32 last_phase=36 cur_target=40 cur_lun=44 active_srb=48
DFH: layout offsetof untagged_srbs=56 tinfo=568 disc_count=664 (tinfo[6]..tinfo[7] = softc+640..663)
DFH: layout tinfo[-1] spans softc556..567: final 16 bytes of untagged_srbs[7][6] (softc552..567) + all of untagged_srbs[7][7] (softc568..575)
DFH: layout tinfo[-1] fields: disc_tag@556 CtrlR1@557 CtrlR3@559 CtrlR4@560 sync_period_reg@561 sync_offset_reg@562
DFH: layout disc_count[-1][0] @softc648 (tinfo[6] tail)
DFH: layout disc_count[-1][1] @softc650 (tinfo[6] tail)
DFH: layout disc_count[-1][2] @softc652 (tinfo[6] tail)
DFH: layout disc_count[-1][3] @softc654 (tinfo[6] tail)
DFH: layout disc_count[-1][4] @softc656 (tinfo[7] tail)
DFH: layout disc_count[-1][5] @softc658 (tinfo[7] tail)
DFH: layout disc_count[-1][6] @softc660 (tinfo[7] tail)
DFH: layout disc_count[-1][7] @softc662 (tinfo[7] tail)
DFH: layout untagged_srbs[-1][0] @softc-8 8 B BEFORE softc (heap hdr)
DFH: layout untagged_srbs[-1][1] @softc0 &amd->dev
DFH: layout untagged_srbs[-1][2] @softc8 &amd->tag
DFH: layout untagged_srbs[-1][3] @softc16 &amd->bsh
DFH: layout untagged_srbs[-1][4] @softc24 &amd->buffer_dmat
DFH: layout untagged_srbs[-1][5] @softc32 &amd->unit+last_phase
DFH: layout untagged_srbs[-1][6] @softc40 &amd->cur_target+cur_lun
DFH: layout untagged_srbs[-1][7] @softc48 &amd->active_srb
DFH: ==== DF-2427 scenario A: poison reselect byte 0x80 (= HostID_Bit), lun 0 ====
DFH: pre-state softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 58fe7981ffffffff]
DFH: pre-state tinfo[6]..[7] softc640 [0000000000000000 0000000000000000 0000000000000000]
DFH: pre-state: disc_count[-1][0] (tinfo[6].goal) = 0x0000, active_srb=0
amd0: Unexpected reselection for target -1, Issuing Abort
DFH: post-reselect: cur_target=-1 cur_lun=0 active_srb=0xffffffff8179fe58 (victim=0xffffffff8179fe58)
DFH: >>> kernel exhibits VULNERABLE (cur_target == -1) behavior <<<
DFH: PASS: amd.c:1831 ffs(0)-1 produced cur_target = -1
DFH: PASS: identify byte decoded lun 0
DFH: PASS: amd.c:1834 OOB READ untagged_srbs[-1][0] (softc-8) loaded wild active_srb
DFH: PASS: amd.c:1845 OOB WRITE untagged_srbs[-1][0]=NULL zeroed softc-8..-1 (pre-ring smashed)
DFH: PASS: rest of pre-ring untouched
DFH: PASS: post ring untouched
DFH: post softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 0000000000000000]
DFH: post tinfo[6]..[7] softc640 [0000000000000000 ffff000000000000 0000000000000000]
DFH: PASS: amd.c:1844 OOB WRITE disc_count[-1][lun]-- decremented 16 bits of tinfo[6].goal (0x0000 -> 0xFFFF)
DFH: chip after amd_Reselect CMD=12 DESTID=ff INTSTAT=04 SYNCPERIOD=77 SYNCOFF=66 C1=aa C3=99 C4=88 DMAcmd=00 (FIFO=00)
DFH: PASS: amd.c:1848 wrote cur_target(-1) as 0xFF to DESTID reg
DFH: *** FAIL: amd.c:1849-1850 loaded sync regs from tinfo[-1] (OOB bytes of untagged_srbs[7][7])
DFH: PASS: amd.c:1851-1853 loaded C1/C3/C4 from tinfo[-1] (OOB bytes of untagged_srbs[7][6])
DFH: follow-on MSG IN: victim SRBState before = 0xaaaa
DFH: follow-on MSG IN: victim SRBState after = 0x0080 (SRB_DISCONNECT=0x0080)
DFH: PASS: amd.c:1218 wrote SRB_DISCONNECT through the wild active_srb into the victim object (2-byte write at an address taken from OOB heap memory)
DFH: PASS: amd.c:1219 second OOB RMW disc_count[-1][0]++ back to 0x0000
DFH: *** FAIL: amd.c:1219 third OOB RMW disc_count[-1][0]++ -> 0x0001 (tinfo[6].goal attacker-steered)
DFH: final tinfo[6]..[7] softc640 [0000000000000000 0000000000000000 0000000000000000]
DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 (field-alias variant; deref=0) ====
amd0: Unexpected reselection for target -1, Issuing Abort
DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0x6ffffffff
DFH: >>> kernel exhibits VULNERABLE (wild active_srb) behavior <<<
DFH: PASS: amd.c:1834 read untagged_srbs[-1][6] == packed (cur_target,cur_lun) -> non-canonical wild pointer
DFH: PASS: amd.c:1845 OOB WRITE untagged_srbs[-1][6]=NULL zeroed cur_target and cur_lun
DFH: PASS: amd.c:1844 OOB dec hit disc_count[-1][6] (tinfo[7].goal 0x0000 -> 0xFFFF)
DFH: chip after amd_Reselect CMD=12 DESTID=ff INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00)
DFH: ==== DF-2427 scenario B: multi-bit byte 0xA8, attacker on wire at ID 5, decodes to target 3 ====
DFH: post-reselect: cur_target=3 cur_lun=0 active_srb=0xffffffff8179fcd8 (target-3 SRB=0xffffffff8179fcd8)
DFH: >>> kernel exhibits VULNERABLE (wrong target accepted) behavior <<<
DFH: PASS: amd.c:1831 decoded WRONG target 3 from attacker ID-5 reselect (confused deputy)
DFH: PASS: amd.c:1834 bound reselection to target 3's SRB -- target-3 I/O now resumes under target-5's nexus
DFH: PASS: amd.c:1844-1845 consumed target-3 disconnect slot
DFH: chip after amd_Reselect CMD=12 DESTID=03 INTSTAT=04 SYNCPERIOD=3a SYNCOFF=0c C1=71 C3=73 C4=74 DMAcmd=00 (FIFO=00)
DFH: PASS: chip reprogrammed for target 3's sync parameters
DFH: PASS: no out-of-struct damage in the in-range variant
DFH: ==== DF-2427 scenario C: valid byte 0xA0 -> target 5 (control) ====
DFH: post-reselect: cur_target=5 cur_lun=0 active_srb=0xffffffff8179fb58 (target-5 SRB=0xffffffff8179fb58)
DFH: PASS: valid reselect binds the correct nexus
DFH: chip after amd_Reselect CMD=12 DESTID=05 INTSTAT=04 SYNCPERIOD=50 SYNCOFF=0f C1=75 C3=35 C4=54 DMAcmd=00 (FIFO=00)
DFH: PASS: chip programmed for target 5
DFH: PASS: control run leaves both canary rings intact
DFH: ########## DF-2427 battery mode=1 END: 2 check(s) failed ##########